The paper investigates the effectiveness of the privacy mode feature in three widely used Web browsers, and outlines how to investigate when these browsers have been used to perform a criminal or illegal act. It performs an identical test on a privacy mode session for each of the three Web browsers and investigates whether traces are left behind. The analysis is done in three phases. First, common places where history and cache records are usually stored are examined. Then, other locations on the local machine are examined using special forensic tools. Also, the physical memory (RAM) is captured and examined for traces. Index Terms-Private browsing, artifacts left by private browsing, incognito, in-private and Firefox private browsing.

In Digital Forensics, the number of person-hours spent on investigation is a key factor which needs to be kept to a minimum whilst also paying close attention to the authenticity of the evidence. The literature describes challenges behind increasing person-hours and identifies several factors which contribute to this phenomenon. This paper reviews these factors and demonstrates that they do not wholly account for increases in investigation time. Using real case records from the Dubai Police, an extensive study explains the contribution of other factors to the increase in person-hours. We conclude this work by emphasizing on several factors affecting the person-hours in contrast to what most of the literature in this area proposes.